Privacy Policy

AnxietyResearch.org is published by shrinkMD Publishing, LLC. The site is editorially independent and operates as a research and reporting publication. We do not provide clinical care, telehealth services, or individualized medical advice through this site.

For the purposes of EU and UK data-protection law, the data controller for this site is shrinkMD Publishing, LLC. To reach the controller about a privacy matter, write to [email protected].

We do not require accounts. We do not ask readers for personal medical information. The data the site directly handles is limited to:

• Standard server access logs generated by the hosting platform (IP address, user agent, requested URL, timestamp)
• A small first-party cookie used to remember your analytics-consent decision (see the Cookie Notice for the current list)
• Where you accept analytics via the consent banner, Google Analytics 4 cookies and the aggregate pageview and event data those cookies enable
• For inbound email: the sender address and message contents, retained in our mail provider

We do not collect names, email addresses, health histories, or any other personally identifying information unless a reader voluntarily provides it by writing to one of our published contact addresses.

The site uses a minimal first-party cookie set. The full list, along with expiries and purpose, is maintained on the Cookie Notice.

For traffic measurement the site uses Google Analytics 4 (measurement ID G-EGSF0SBNSK, provided by Google LLC). Analytics are off by default. On first visit a consent banner asks whether you want to accept analytics or continue without them. Only if you accept do the two Google Analytics cookies (_ga and _ga_EGSF0SBNSK) get written and only then does Google receive event data. Your decision is remembered on your device and can be changed at any time on the Cookie Notice page. The site does not set advertising cookies, does not run advertising, does not sell reader data, and does not use Google Analytics for advertising personalization. Ad-storage and ad-personalization signals are set to denied at the Google Consent Mode level, regardless of your analytics choice.

If you accept analytics, the site also records a few custom events. When you click a link to another Shrink Network site, it records network_journey_out with the destination site, a campaign label, and the page you clicked from, and it sends a matching network_journey_in event to the destination site's own Google Analytics property so both sites can count the visit. When you use site search, it records only how long the query was and how many results came back, never the words you typed. When you land on a page that doesn't exist, it records the missing address so we can fix broken links.

Shrink Network sites share Google Analytics cross-domain measurement. When you follow a link from this site to another Shrink Network site after accepting analytics, a short _gl parameter is added to the link so the two visits are counted as one session instead of two. It carries a pseudonymous analytics identifier, not your name or contact details. None of this runs if you decline analytics, and every event is gated by the same consent as the pageview stream.

The site relies on a small number of subprocessors for hosting and delivery:

• Hosting and CDN. Application hosting and edge delivery for the site's pages and assets.
• Domain DNS. DNS resolution for anxietyresearch.org.
• Email. Inbound and outbound editorial email for the addresses published on the Contact page.
• Web fonts. Self-hosted where possible; some font files may be served from a third-party font CDN that may log IP addresses in standard server logs.
• Analytics. Google LLC, operating Google Analytics 4. When you accept analytics via the consent banner, Google receives aggregate pageview and event data associated with two first-party cookies. Google is a US-based processor; see "International data transfers" below for the transfer mechanism we rely on.

Each processor receives only the data needed to perform its function. We do not transfer aggregated analytics or reader email data to advertisers, brokers, or any commercial third party.

• Server access logs. Retained for up to 30 days for security and abuse-prevention purposes, then deleted or rotated.
• Google Analytics user and event data. Retained by Google for up to 14 months from last activity per the Google Analytics 4 retention setting configured on the property, after which it is deleted from Google's systems.
• Editorial email. Retained for up to 24 months from the last message in a thread, then deleted unless the message is part of an active correction or legal matter.
• DMCA and rights notices. Retained for the period required by 17 U.S.C. § 512 and applicable record-keeping rules.

External links on this site (NIMH, CDC, SAMHSA, peer-reviewed publishers, government dashboards, crisis lines, treatment locators) transfer the reader to a third-party site governed by that site's own privacy practices. We do not control and are not responsible for the privacy practices of linked third parties.

Under the GDPR and UK GDPR, we rely on the following legal bases:

• Consent (Article 6(1)(a)). Google Analytics 4 measurement and the network-journey event, both of which fire only after you accept via the consent banner.
• Legitimate interests (Article 6(1)(f)). Security logging, abuse prevention, and editorial responses to reader email.
• Legal obligation (Article 6(1)(c)). Retention of DMCA notices and responses.

You can withdraw analytics consent at any time on the Cookie Notice page. Withdrawal does not affect the lawfulness of processing carried out while consent was in force.

Depending on the reader's jurisdiction, applicable laws provide rights to access, correct, delete, restrict, or port personal data, to object to processing, and to lodge a complaint with a supervisory authority. These include the California Consumer Privacy Act as amended by the CPRA, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, the Utah UCPA, the Texas TDPSA, the EU GDPR, and the UK GDPR.

California readers also have the right to opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioral advertising), the right to limit use of sensitive personal information (we do not knowingly collect any), and the right to non-discrimination for exercising any of these rights.

To make a request, write to [email protected]. Because we do not maintain reader accounts, the personal data we hold about any individual is limited; we may ask for information sufficient to verify your identity or, in the case of email correspondence, the email address used in the original exchange. We respond within 30 days for GDPR/UK GDPR requests and within 45 days for CCPA/CPRA requests, with a possible extension where the law allows.

EU and UK readers may also lodge a complaint with their national supervisory authority. UK readers may complain to the Information Commissioner's Office (ICO).

The site is hosted in the United States and edited from the United States. Where reader data is processed in the United States (for example, via hosting, email providers, or Google Analytics), we rely on the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum with relevant subprocessors, and, for transfers to Google LLC, on Google's certification under the EU-US Data Privacy Framework (DPF), the UK Extension to the DPF, and the Swiss-US DPF as applicable.

The site is not directed at children under 13 and is not a "child-directed online service" under COPPA. We do not knowingly collect data from children under 13. A parent or guardian who believes a child has provided personal information should contact us and we will delete that information.

We use commercially reasonable technical and organizational measures to protect the limited data we process, including TLS for site traffic, restricted access to administrative systems, and timely security updates. No system is perfectly secure. If we become aware of a personal-data breach affecting reader data, we will notify affected readers and applicable supervisory authorities as required by law (including within 72 hours where the GDPR or UK GDPR applies).

Reader email sent to addresses on this site is not encrypted in transit by default and should not contain personal health information, clinical details, or other sensitive medical data. For clinical concerns, contact a licensed clinician. In a crisis, call or text 988 in the United States, or call 911. International readers, see Notice to International Readers.

The site honors the Global Privacy Control (GPC) signal for analytics. If your browser sends Sec-GPC: 1 or exposes navigator.globalPrivacyControl === true on your first visit, we treat that as a declined analytics decision automatically. No banner is shown, no Google Analytics cookies are written, and no analytics events are sent. You can still choose to accept analytics later on the Cookie Notice page. The site does not run advertising and does not sell reader data, so the "sale/share" opt-out concept does not apply here in the CCPA sense.

Material updates to this policy are noted at the top of the page with a new "Last updated" date. We maintain a brief changelog at the bottom of this page when meaningful changes occur. There are no entries yet.